Provides a methodology for identifying authentication bypasses, session fixation, and credential stuffing vulnerabilities.
Install
mkdir -p .claude/skills/broken-authentication-testing-h4d3zs && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/13852" && unzip -o skill.zip -d .claude/skills/broken-authentication-testing-h4d3zs && rm skill.zipInstalls to .claude/skills/broken-authentication-testing-h4d3zs
Activation
This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.
This skill should be used when the user asks to "test for broken authentication vulnerabilities", "assess session management security", "perform credential stuffing tests", "evaluate password policies", "test for session fixation", or "identify authentication bypass flaws". It provides comprehensive techniques for identifying authentication and session management weaknesses in web applications.Key capabilities
- →Identify authentication and session management vulnerabilities
- →Test password policies for strength and resilience
- →Perform credential enumeration and brute force testing
- →Assess session management security, including fixation and timeout
- →Evaluate multi-factor authentication implementations
How it works
The skill systematically tests web applications for broken authentication by analyzing password policies, performing credential attacks, and evaluating session handling and multi-factor authentication.
Inputs & outputs
When to use Broken Authentication Testing
- →Test for session fixation vulnerabilities
- →Evaluate password policy strength
- →Run credential stuffing tests
About this skill
Broken Authentication Testing
Purpose
Identify and exploit authentication and session management vulnerabilities in web applications. Broken authentication consistently ranks in the OWASP Top 10 and can lead to account takeover, identity theft, and unauthorized access to sensitive systems. This skill covers testing methodologies for password policies, session handling, multi-factor authentication, and credential management.
Prerequisites
🧠 Knowledge Modules (Fractal Skills)
1. Required Knowledge
2. Required Tools
3. Required Access
4. Phase 1: Authentication Mechanism Analysis
5. Phase 2: Password Policy Testing
6. Phase 3: Credential Enumeration
7. Phase 4: Brute Force Testing
8. Phase 5: Credential Stuffing
9. Phase 6: Session Management Testing
10. Phase 7: Session Fixation Testing
11. Phase 8: Session Timeout Testing
12. Phase 9: Multi-Factor Authentication Testing
13. Phase 10: Password Reset Testing
14. Common Vulnerability Types
15. Credential Testing Payloads
16. Session Cookie Flags
17. Rate Limiting Bypass Headers
18. Legal Requirements
19. Technical Limitations
20. Scope Considerations
21. Example 1: Account Lockout Bypass
22. Example 2: JWT Token Attack
23. Example 3: Password Reset Token Exploitation
When not to use it
- →When the user asks for general security advice not related to authentication
- →When the scope is outside web application security testing
Limitations
- →The skill focuses on authentication and session management vulnerabilities.
- →Testing methodologies are for web applications.
- →The skill does not cover all types of web security vulnerabilities.
How it compares
This skill provides a structured, multi-phase testing methodology specifically for broken authentication, covering a wide range of attack vectors and common vulnerability types, unlike a general security scanner.
Compared to similar skills
Broken Authentication Testing side by side with the closest alternatives in the catalog.
| Skill | Installs | Updated | Safety | Difficulty |
|---|---|---|---|---|
| Broken Authentication Testing (this skill) | 0 | 3mo | No flags | Advanced |
| 1password | 27 | 3mo | Review | Intermediate |
| security-compliance | 19 | 7mo | Review | Advanced |
| information-security-manager-iso27001 | 11 | 7mo | Review | Advanced |
Try saying
Example prompts that trigger this skill in your AI assistant.
More by H4D3ZS
View all by H4D3ZS →You might also like
1password
openclaw
Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in (single or multi-account), or reading/injecting/running secrets via op.
security-compliance
davila7
Guides security professionals in implementing defense-in-depth security architectures, achieving compliance with industry frameworks (SOC2, ISO27001, GDPR, HIPAA), conducting threat modeling and risk assessments, managing security operations and incident response, and embedding security throughout the SDLC.
information-security-manager-iso27001
davila7
Senior Information Security Manager specializing in ISO 27001 and ISO 27002 implementation for HealthTech and MedTech companies. Provides ISMS implementation, cybersecurity risk assessment, security controls management, and compliance oversight. Use for ISMS design, security risk assessments, control implementation, and ISO 27001 certification activities.
cursor-sso-integration
jeremylongshore
Configure SSO and enterprise authentication in Cursor. Triggers on "cursor sso", "cursor saml", "cursor oauth", "enterprise cursor auth", "cursor okta". Use when working with cursor sso integration functionality. Trigger with phrases like "cursor sso integration", "cursor integration", "cursor".
springboot-security
affaan-m
Spring Security best practices for authn/authz, validation, CSRF, secrets, headers, rate limiting, and dependency security in Java Spring Boot services.
django-security
affaan-m
Django security best practices, authentication, authorization, CSRF protection, SQL injection prevention, XSS prevention, and secure deployment configurations.